company
Dark Reading is a cybersecurity news publication covering data breaches, vulnerabilities, malware, and enterprise IT security trends.
No evidence-backed relationships are recorded.
Unsloth fixed Studio in version 2026.6.9 after Pillar Security showed that reading a malicious model's config.json could run an attacker's Python code. Unsloth disputed parts of the finding and declined to publish an advisory, so no CVE was assigned.
Reality
Proofpoint says an unknown actor sprayed over 5,700 M365 accounts in Chile and breached only seven, all dormant service accounts at one retailer. Employee logins held, and those seven unused accounts still gave the attacker mail, Teams chats, OneDrive files and, in one case, the Azure portal.
Reality
Kaspersky says a previously unknown multi-stage loader has spread since mid-August through a compromised public torrent archive. It reaches its command server through the Solana blockchain. Victims include government and transport organisations.
Reality
SOCRadar's teardown of the $250-a-month service puts the elevation step behind an administrator account and permissive UAC settings, so on a fleet of standard users the rental buys remote access and credential theft and stops there.
Reality
The malware asks for accessibility, then has a second component build a work profile and copy the bank app into it. Group-IB says the clone registers with the bank as a new device while a black screen hides the transfer.
Reality
Microsoft Security Research describes callers posing as IT staff to get a Microsoft 365 session relayed or minted to their own client. The lasting damage comes from the MFA method they then register.
Reality
VulnCheck found a root command channel in ZBT-derived OEM firmware that the default WAN firewall leaves open. Only the board ID and the firmware hash tell you whether your branch office is running it.
Reality
The hidden-keyword trick that once fooled Bayesian spam scoring now lands inside an LLM's context window. The one component that could strip it is deliberately built to leave styling alone.
Reality
Island's write-up describes an adversary-in-the-middle proxy that hands passwords, push approvals and SMS codes to real Microsoft servers, then keeps the cookie Microsoft issues. Origin binding is the only listed control that breaks it.
Reality
A passenger reportedly replaced a Delta flight's in-flight Wi-Fi with their own network and a phishing page. It surfaced the same week the administration floated paying private firms to hack back.
Reality
Acronis says Pakistan's Transparent Tribe is running new Patchcord and Sheetcord implants against Afghan government and telecom targets, with no confirmed compromises in India.
Reality